Change Load Order of AntiforgeryToken (OrchardCMS#3993)

scleaver · Aug 12, 2019 · 39a12af · 39a12af
1 parent 479f51e
commit 39a12af
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/OrchardCore/OrchardCore.Mvc.Core/Startup.cs b/src/OrchardCore/OrchardCore.Mvc.Core/Startup.cs
@@ -38,7 +38,9 @@ public override void ConfigureServices(IServiceCollection services)
             var builder = services.AddMvc(options =>
             {
                 // Forcing AntiForgery Token Validation on by default, it's only in Razor Pages by default
-                options.Filters.Add(typeof(AutoValidateAntiforgeryTokenAttribute), 1000);
+                // Load this filter after the MediaSizeFilterLimitAttribute, but before the
+                // IgnoreAntiforgeryTokenAttribute. refer : https://github.com/aspnet/AspNetCore/issues/10384
+                options.Filters.Add(typeof(AutoValidateAntiforgeryTokenAttribute), 999);
 
                 // Custom model binder to testing purpose
                 options.ModelBinderProviders.Insert(0, new CheckMarkModelBinderProvider());